3 ms·
> some AEADs (including AES-GCM) suffer catastrophic failures of confidentiality and/or integrity when two distinct messages are encrypted with the same k
by praseodym 8y ago
> some AEADs (including AES-GCM) suffer catastrophic failures
of confidentiality and/or integrity when two distinct messages are
encrypted with the same key and nonce. While the requirements for
AEADs specify that the pair of (key, nonce) shall only ever be used
once, and thus prohibit this, this is a worry in practice.
Could anyone explain what this catastrophic failure entails? Do both messages suddenly get decryptable, or is the entire AES key compromised?
- deleted 8y ago[deleted]
- CiPHPerCoder 8y agoYou immediately lose your integrity protections, which allows you to launch attacks against AES-CTR as if it had no authentication tag. https://cryptologie.net/article/361/breaking-https-aes-gcm-or-a-part-of-it/ https://cryptologie.net/article/361/breaking-https-aes-gcm-o...
- amluto 8y agoYou also learn the XOR or the two plaintexts, which can be a catastrophic loss of confidentiality.
- joe_xyz 8y agoYou can also determine the keyed hash function key if you collect enough plaintexts, which would let you forge authentication tags https://csrc.nist.gov/csrc/media/projects/block-cipher-techniques/documents/bcm/comments/800-38-series-drafts/gcm/joux_comments.pdf https://csrc.nist.gov/csrc/media/projects/block-cipher-techn...
- throwaway2048 8y agoIts worse than that with AES-GCM, nonce reuse reveals the AES private key.
- wolf550e 8y agovideo: https://www.youtube.com/watch?v=uxuXFK5XKEU https://www.youtube.com/watch?v=uxuXFK5XKEU presentation: https://www.blackhat.com/docs/us-16/materials/us-16-Devlin-Nonce-Disrespecting-Adversaries-Practical-Forgery-Attacks-On-GCM-In-TLS.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Devlin-N... whitepaper: https://www.blackhat.com/docs/us-16/materials/us-16-Devlin-Nonce-Disrespecting-Adversaries-Practical-Forgery-Attacks-On-GCM-In-TLS-wp.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Devlin-N...
- blattimwind 8y agoGCM/GHASH is a Carter-Wegman MAC. These all have in common that they tend to be highly efficient, but their problem is that they require a unique key for each message; when a key is reused, an attacker can forge MACs. This is unlike e.g. HMAC where you don't even have a per-message key/IV. The same caveats thus apply to e.g. Chacha20-Poly1305 (keystream out of counter mode XOR plaintext for encryption, Carter-Wegman MAC).